Use the 1Password provider for Pulumi

You can use the 1Password provider for Pulumi to access and manage items in your 1Password vaults.

Requirements

The provider can be configured to authenticate with a service account, a Connect server, or with your 1Password account details.

Service account
Connect server
Account details

1Password Service Accounts allow you to restrict the provider’s access to specific vaults in your 1Password account, so you can follow the principle of least privilege in your project.To use a service account with the 1Password provider for Pulumi, you’ll need:

Step 1: Install the 1Password provider for Pulumi

With a package manager

Node.js
Python
Go

To use the provider with JavaScript or TypeScript in Node.js, install using either npm or yarn:

npm install @1password/pulumi-onepassword

yarn add @1password/pulumi-onepassword

To use the provider with Python, install using pip:

pip install pulumi_onepassword

To use the provider with Go, use go get to download the latest version:

go get github.com/1Password/pulumi-onepassword/sdk/go/...

With the provider binary

To install the 1Password provider binary, use the pulumi plugin command:

pulumi plugin install resource onepassword <version> --server github://api.github.com/1Password/pulumi-onepassword

Step 2: Configure the provider with your credentials

You can provide your 1Password credentials to Pulumi in the environment or in your Pulumi configuration. Your Pulumi configuration is a good option if you want to store your credentials alongside your Pulumi stack for multi-user access.

Service account
Connect server
Account details

Create a service account or find the token for an existing service account. Make sure the service account has access to the appropriate vaults and adequate permissions in those vaults.
Provide the token to Pulumi using either an environment variable or your Pulumi configuration.

Environment variable

Pulumi configuration
Make sure to pass --secret when setting sensitive data.
Install 1Password CLI in your PATH. If you install the CLI outside of your PATH, specify the path to your 1Password CLI binary using either an environment variable or your Pulumi configuration.

Environment variable

Pulumi configuration

Create a Connect server or find the host URL and token for an existing Connect server.

Provide the host URL and token to Pulumi using either environment variables or your Pulumi configuration.

Environment variables

Bash, Zsh, sh
fish
PowerShell

Host URL

export OP_CONNECT_HOST=<your-connect-server-host-url>

Token

export OP_CONNECT_TOKEN=<your-connect-server-token>

Host URL

set -x OP_CONNECT_HOST=<your-connect-server-host-url>

Token

set -x OP_CONNECT_TOKEN=<your-connect-server-token>

Host URL

$Env:OP_CONNECT_HOST=<your-connect-server-host-url>

Token

$Env:OP_CONNECT_TOKEN=<your-connect-server-token>

Pulumi configuration

Host URL Token Make sure to pass --secret when setting sensitive data.

Find the sign-in address or unique identifier for your 1Password account.
Provide your account sign-in address or identifier to Pulumi using an environment variable or your Pulumi configuration.

Environment variable
- Bash, Zsh, sh
- fish
- PowerShell
export OP_ACCOUNT=<your-account-details>
set -x OP_ACCOUNT=<your-account-details>
$Env:OP_ACCOUNT=<your-account-details>
Pulumi configuration
Make sure to pass --secret when setting sensitive data.
Install 1Password CLI in your PATH. If you install the CLI outside of your PATH, specify the path to your 1Password CLI binary using either an environment variable or your Pulumi configuration.

Environment variable
- Bash, Zsh, sh
- fish
- PowerShell
export OP_CLI_PATH=<path-to-your-cli-binary>
set -x OP_CLI_PATH=<path-to-your-cli-binary>
$Env:OP_CLI_PATH=<path-to-your-cli-binary>
Pulumi configuration
To use Touch ID, Windows Hello, or another system authentication option with the provider, turn on the 1Password CLI app integration.

Step 3: Use the provider

See Pulumi’s documentation to learn how to access and manage your items using the 1Password provider.

Reference

You can use either Pulumi configuration keys or environment variables to provide your 1Password credentials to Pulumi.

Configuration key	Environment variable	Description	Authentication method
`pulumi-onepassword:service_account_token`	`OP_SERVICE_ACCOUNT_TOKEN`	The string value of your 1Password Service Account token.	Service account
`pulumi-onepassword:url`	`OP_CONNECT_HOST`	The URL where your 1Password Connect Server can be found. For example: `http://localhost:8080`.	Connect server
`pulumi-onepassword:token`	`OP_CONNECT_TOKEN`	The string value of your Connect server token.	Connect server
`pulumi-onepassword:account`	`OP_ACCOUNT`	A 1Password account sign-in address or unique identifier.	Account details
`pulumi-onepassword:op_cli_path`	`OP_CLI_PATH`	The path to your 1Password CLI binary. Only required if 1Password CLI binary is located outside of your PATH.	Service account Account details

​Requirements

​Step 1: Install the 1Password provider for Pulumi

​With a package manager

​With the provider binary

​Step 2: Configure the provider with your credentials

​Environment variable

​Pulumi configuration

​Environment variable

​Pulumi configuration

​Environment variables

​Pulumi configuration

​Environment variable

​Pulumi configuration

​Environment variable

​Pulumi configuration

​Step 3: Use the provider

​Reference

Requirements

Step 1: Install the 1Password provider for Pulumi

With a package manager

With the provider binary

Step 2: Configure the provider with your credentials

Environment variable

Pulumi configuration

Environment variable

Pulumi configuration

Environment variables

Pulumi configuration

Environment variable

Pulumi configuration

Environment variable

Pulumi configuration

Step 3: Use the provider

Reference